Cisco, Community and Open Source

In July we told you about Sourcefire’s agreement to be acquired by Cisco, and today that acquisition has closed – we are now one company. This also means that we are also now one community, and Cisco has reiterated its commitment to maintaining our innovation and support of Snort, ClamAV and other open source projects, as well as its own projects. As Marty Roesch wrote on our corporate blog:

“I can tell you with certainty that this is a great match for Sourcefire, for Cisco and, ultimately, for our customers, partners and open source communities… Beyond the technology, one of the things that is important to me is that Cisco and Sourcefire both share key values that transcend our company names, HQ locations and number of employees. “

 I’m also happy to report that there will be no changes to how our communities are run or our communications, including mailing lists, snort.org, clamav.net or social media sites. Please visit the corporate blog for more details and, as always, reach out to me with questions. I will still be your community manager and I look forward to many more years of being a part of this community.

Martin Roesch on Snort’s history and the Sourcefire Acquisition

Dennis Fisher talks with Martin Roesch, the author of the Snort IDS and founder of Sourcefire, about the evolution of Snort from a side project to an open-source security powerhouse to the technological basis for a hugely successful company.

http://threatpost.com/martin-roesch-on-snorts-history-and-the-sourcefire-acquisition/101510

A great podcast with some history and where we are headed.

The Agile Security Manifesto

I may have to break out my 'old man pants' on this blog post.

Awhile back, over on the Sourcefire corporate blog, we put out what we called the "Agile Security Manifesto".  A series of 12 or so blog posts that detailed what we (Sourcefire corporate) really meant by our Agile Security message.

When I started working with Snort, this would have been around 2001, I was in the military and I believed that what I was doing, protecting networks, was my little corner of the Army sphere.  I believed that my goal was to protect everything that I could the best that I could, and so I tried to use the tools and develop the methodologies that allowed me and my team to do that.  Here it is 2012, and I still believe that.

I read the blog posts that various people at Sourcefire wrote on the corporate blog and I liked them.  Heck, even Matt Olney liked them over on the VRT blog.  Anytime you can show the VRT something we can get behind, I'm betting 99.9 times out of 100, it isn't going to be tied to marketing.  But for Matt it was different, and it's different for me too.

Internally we put these twelve blog posts into a PDF and we sent it around for people to read and to share with people.  I asked our VP of Corporate Communications if I could put it out on the Snort blog.  Not behind a Marketing signup, just out there, free for download so that people could read what is so near and dear to the core of what and who Sourcefire is.

This PDF reads like a mission statement to me.  Even if people people aren't using our products, or even if people have no intention of buying our products, this PDF inspired me and makes me want to move forward and invent the next great thing.  It makes me want to dedicate time to making sure that my customers remain secure from as many threats as we can protect them from.

Tech people hate to be marketed to, they love a solution, they love an outlook, they like to believe there is a light at the end of the tunnel.  People generally want to be believe that what they are doing is making a difference.  At least I do.

When I write detection and the next day I receive a ton of feedback via support and email asking for feedback on some rule that I just wrote and shipped and suddenly is catching some new attack strain, I see the results of my work.  The VRT thrives on this.  We love to see that what we are doing isn't just going out into the ether.  We like to see what we are doing is making a difference.

This blog post series is what we are about, what we believe, and what we are striving for, and now, it's available for download here:

http://www.sourcefire.com/agile-security/manifesto

Daemonlogger native package now in OpenWRT trunk!

My patch for building Daemonlogger as a native OpenWRT package has been accepted into the mainline distribution and committed to trunk. Pre-built binary packages are now available for all supported
architectures in the nightly snapshots tree.

Unfortunately these packages only work on the latest trunk firmware builds at the moment, and the 3.2 kernel along with the extra software included in these builds does not leave enough free JFFS space or usable RAM to run daemonlogger effectively. I'm trying to convince the developers to include this in the next stable release of Backfire (10.03.2) based on the 2.6 kernel, but no luck yet.

For the time being you can still grab my binary package from my GitHub repository. This one *does* install and run cleanly on the current stable version of Backfire (10.03.1).

- Announcement: http://goo.gl/Wy5G8
- Downloads: https://github.com/vineyard/WRT-SPAN

Cheers,
Robert Vineyard

2012 Snort Scholarship is now open!

Annually, Sourcefire provides a Snort Scholarship to two individuals selected at random (by drawing) in the amount of $5000 US for higher education purposes.  The winners also receive a 10,000 credit to use toward any training courses or certification exam in the Sourcefire Security Education Program.

To be eligible, you must meet the legal criteria found here on our website, sign up for the scholarship here, and following that, on or about May 31, 2012, two winners will be selected.

For further information, please see the links above, also found linked here.

VRT Rule release for 02/09/2012

Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 10 new rules and made modifications to 4172 additional rules.

There were no changes made to the snort.conf in this release.

Today, we leveled the playing field between the various ways to get Snort rules. It has long been the case where Sourcefire products, by default, enabled rules in the balanced-ips policy.  

When you use PulledPork (http://code.google.com/p/pulledpork/), this is also the default behavior. But when you simply downloaded the rules from Snort.org, the rules were a hodge podge of rules that were enabled or disabled, denoted by whether or not the rule was commented out in the rules file.

In an effort to make the barrier to entry that much easier, the Open Source rule package downloaded on snort.org now exactly mirrors what you would get if you used PulledPork. All rules in balanced-ips are enabled and all rules not in balanced-ips are disabled. The exception to this is that rules that set flowbits that are used by rules that are in balanced-ips are also enabled. This means that the default Open Source ruleset will now provide a good balance between speed, performance, and detection and all rules should work as expected.  Those using Oinkmaster, or simply downloading the ruleset directly, will now be running the "balanced-ips" policy.  A rule's "on/off" state is now dictated by policy.

This change is in no way an indication that PulledPork is not the recommended way to manage your Open Source ruleset. PulledPork also tracks your own custom policy tailored to your environment and provides other benefits. If you want to use the security-ips policy, you may go through and enable these rules by default, or choose the easy way and use PulledPork to manage this for you. So, use PulledPork if you aren't already!

 In VRT's rule release:

Synopsis: This release adds and modifies rules in several categories.

Details: The Sourcefire VRT has added and modified multiple rules in the attack-responses, backdoor, bad-traffic, blacklist, botnet-cnc, chat, dns, dos, exploit, file-identify, finger, icmp, icmp-info, imap, misc, multimedia, netbios, nntp, oracle, p2p, password, policy, pop3, rpc, rservices, scada, scan, shellcode, smtp, specific-threats, spyware-put, sql, username, voip, web-activex, web-cgi, web-client, web-iis, web-misc and x11 rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Sourcefire - SC Award Nominee for Best IPS/IDS and Best Cloud Security

"It’s crunch time for security enthusiasts who are preparing for next year’s RSA Conference in San Francisco. One key item is gearing up for the SC Awards - ‘the Oscars’ of the week’s events - which honors best-in-class security products.

Each year the SC Awards honor companies whose products have most strongly contributed to the security and reliability of North America’s IT industry. Sourcefire is honored to have been nominated in two categories:

1. Best IPS/IDS for our breadth of IPS solutions
2. Best Cloud Security for our Virtual 3D sensor

The voting process runs through October 7. Voting is open to SC Magazine subscribers who are security end users and practitioners - 25,000 of which have been pre-approved by the magazine.

If you fit into this description, and truly believe that Sourcefire technologies are the best of the best, please vote today.

Finalists for all categories will be announced the first week of November and the winners will be announced on Feb. 28, 2012, at the SC Awards U.S. Dinner at RSA Conference in San Francisco.

Wish us luck!"

-- Marc Solomon
Originally posted here.  Reposted for the Snort.org audience.

Sourcefire Recognizes Seventh Annual SNORT Cybersecurity Scholarship Winners

Columbia, MD – June 28, 2011 – Sourcefire, Inc. (Nasdaq: FIRE), the creator of Snort® and a leader in intelligent cybersecurity solutions, today announced that it has selected Darcie Cohee and Daniel Freer as the recipients of the 2011 Snort Scholarship. The scholarships, each worth up to $15,000, are awarded to university students around the world that use Snort to further their education and gain hands-on experience in network security.

“As hackers continue to find new ways to access sensitive corporate and customer data, we need to groom a new generation of security professionals to identify and combat these exploits,” said Martin Roesch, CTO and founder of Sourcefire. “Snort and Sourcefire are built on the foundation of community development and these scholarships allow us to recognize the next great security professionals.”

To qualify, applicants must be enrolled in a university that uses Snort or Sourcefire products to protect its network or uses Snort as part of the curriculum in the classroom. The scholarships assist the winning students in completing their degrees and covering educational costs. Sourcefire selected Darcie and Daniel from a pool of hundreds of applicants:

• Darcie Cohee is a Bachelor of Science candidate in Information Systems Technologies at Southern Illinois University Carbondale. Darcie has worked on several projects using Snort to protect SharePoint deployments and is interested in the intersection of the Web and security.
• Daniel Freer is a Bachelor of Science candidate in Networking at Indiana Tech. Daniel relied on Snort as an important weapon in his arsenal when he competed in the National Collegiate Cyber Defense Competition and is committed to exploring how Snort can help prevent evolving attacks.

To assist the winning students in completing their degrees, Sourcefire has awarded each a $5,000 scholarship for educational costs at the students’ respective universities. The winners also receive a $10,000 credit to use toward any training course or certification exam in the Sourcefire Security Education Program. The Sourcefire Security Education and Certification Programs deliver training and testing for IT staff on Sourcefire’s products and open source security solutions, either on-site or at dedicated locations around the world.

Sourcefire developed the Snort Scholarship in 2004 as a way to give back to the open source and security communities. Since the inception of the Snort Scholarship program seven years ago, Sourcefire has recognized university students from around the world, including the United States, Australia, Turkey, Mexico, the Netherlands and Rwanda. Martin Roesch founded Sourcefire in 2001 to deliver commercial security solutions that leverage his open source innovation, Snort. Snort is the world’s most widely deployed intrusion detection and prevention technology with more than 300,000 registered users and nearly 4 million downloads to date. As the de facto standard for intrusion detection and prevention, Snort is used extensively by Fortune 100 enterprises and government agencies.

About Sourcefire
Sourcefire, Inc. (Nasdaq:FIRE), is a world leader in intelligent cybersecurity solutions.  Sourcefire is transforming the way Global 2000 organizations and government agencies manage and minimize network security risks. Sourcefire’s IPS, Real-time Network Awareness and Real-time Adaptive Security solutions equip customers with an efficient and effective layered security defense – protecting network assets before, during and after an attack. Through the years, Sourcefire has been consistently recognized for its innovation and industry leadership by customers, media and industry analysts alike – with more than 50 awards and accolades. Today, the name Sourcefire has grown synonymous with innovation and network security intelligence. For more information about Sourcefire, please visit http://www.sourcefire.com.

Sourcefire, the Sourcefire logo, Snort, the Snort and Pig logo, ClamAV, Immunet and certain other trademarks and logos are trademarks or registered trademarks of Sourcefire, Inc. in the United States and other countries. Other company, product and service names may be trademarks or service marks of others.

Marty speaking at new CyberSecurity Seminar Series at the University of Maryland

Google is now sponsoring a CyberSecurity Seminar Series at the University of Maryland, featuring speakers from the industry, academia, and government, addressing a broad range of topics related to cybersecurity, including technology, policy, and economics.

One of the speakers confirmed for the Seminar Series is our own Martin Roesch!

Check out this excerpt from the press release:

The second seminar will be held on Thursday, April 21, at 5:00 p.m., and will feature Martin Roesch, Chief Technology Officer (CTO) of Sourcefire®, a leader in intelligent cybersecurity solutions. The title of his talk will be "Intrusion Detection and Network Security Perspectives From A Veteran."

With nearly 20 years of industry experience in network security and embedded systems engineering, Roesch has dedicated himself to developing intelligent network security tools and technologies to address evolving threats. A respected authority on intrusion prevention and detection technology and forensics, Roesch has been interviewed as an industry expert in multiple technology publications, as well as print and online news services, such as MSNBC, Wall Street Journal, CNET, ZDNet, and numerous books. Roesch founded Sourcefire® in 2001 and is the author and lead developer of the Snort® Intrusion Prevention and Detection System that forms the foundation for the Sourcefire IPSTM. Roesch has received a host of awards of his technology innovation and vision. Most recently, he was recognized as a 2010 Security Superstar by Everything Channel's CRN magazine for the value his innovations provide partners and customers, and was selected as one of eWeek's Top 100 Most Influential People in IT

I hope you have the opportunity to attend!

Snort Webcast Series is back

When I took over the OpenSource Community Manager position here at Sourcefire, I sent out an email asking for suggestions about what I can do to make things better and provide an awesome community for the OpenSource products.

One of the things that was emailed to me was "Can you put the Snort Webcast Series back up?"  and "Start the webinar series back up!".  So, I did, and we will.

You can find the old series that Mike Guiterman (thanks Mike!) was coordinating back in 2009, re-released and put up on Snort.org.  It's always been available, but over on Sourcefire.com where you had to register to view the content.  This is one of the other complaints I received, that people had to surrender their email to the website in order to gain access to this valuable information.

So I removed that restriction as well.

So, announcing without further ado, the old series is back up, and we're going to be reviving the series soon (probably once a month or so), and putting that information up for consumption as well.  As always I'll post a blog entry when we are going to schedule a webcast, so you may participate live and ask questions of the speakers, and I'll post a blog entry when we put it up on the website for archiving.

You can find the Snort webcast series here, at it's new home, on Snort.org.

VRT Rule Update for 03/15/2011, MS Tues

Just released, is a rule release for today from the VRT. In this release we introduce 11 new rules and make modifications to 2 more.

In VRT's rule release:

Details:

Adobe Security Advisory APSA11-01:
Adobe Flash Player contains a programming error that may allow a remote
attacker to execute code on an affected system. This problem affects
the Microsoft Windows, Apple Mac OS, Linux and Solaris operating
systems.

The Sourcefire VRT have reports of this vulnerability being exploited
in the wild via an embedded Flash file in a Microsoft Excel document
delivered via email.

Rules to detect attacks targeting this vulnerability are included in
this release and are identified with GID 3, SID 18543, GID 1, SIDs
18545 through 18554.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

VRT Rule Update for 03/03/2011

Just released, is a rule release for today from the VRT. This release is much larger than yesterdays and makes changes to 573 rules.

In VRT's rule release:

Details:

As a result of ongoing research, the Sourcefire VRT has added and modified multiple rules in the backdoor, blacklist, botnet-cnc, chat, deleted, dos, exploit, icmpv6, imap, netbios, policy, scada, smtp, specific-threats, voip-sip, web-activex, web-cgi, web-client, web-misc, and web-php rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!

Improving your Custom Snort Rules -- New Whitepaper Posted

Originally posted in December's hackin9 magazine, Leon Ward authored this paper entitled "Improving your Custom Snort Rules".  We've just added this document to the http://www.snort.org/docs page under "Snort Related Whitepapers".

So be sure and check it out.

Thanks go out to Leon Ward, Alex Kirk, and Dave Venman of Sourcefire for this document.

Sourcefire wins Best IDS/IPS - SC Magazine US

This week out at RSA, SC Magazine gives away their annual "best of" awards. Sourcefire won this award, citing our innovation, detection, and of course our wonderful 300,000+ strong Snort community (you all!).

While it mentions in the article that Sourcefire is "based  on Snort".  Our detection engine IS Snort.  It's the ease of use, other technologies, and GUIs that set Sourcefire apart.

We'd like to thank the Snort Community for all the bugs they file, the false positive reports, the ideas, and the criticisms. This only serves to make our IPS, community, and detection better.

Thank you all!

Best IDS/IPS - SC Magazine US

Snort 2.9.0.4 Install Guide for Fedora Core 14 is posted

Our own Nick Moore of Sourcefire has published his guide for installing Snort 2.9.0.4 on Fedora Core 14.  Thanks Nick!  Great job!

Please see http://snort.org/docs for the complete guide.

Snort 2.9.0.4 port for FreeBSD now available

Last version of Snort (2.9.0.3) Sourcefire's own Dean Freeman started maintaining the official FreeBSD port of Snort, which allows faster updates from Snort release to port package.

Case in point is today's release of Snort 2.9.0.4 in FreeBSD's port system.

We would also like to thank Michael Scheidell of SECNAP for helping out a lot getting Snort bootstrapped and read to go with the Snortsam patches in the port system as well!

Thanks!

SQueRT 0.8 has been released

SQueRT 0.8, a web GUI interface for SGuiL's database format (SGuiL uses Snort) has been released. Check out the below note from Paul Halliday:

-- country mappings can now be done in the background via cron
-- an input box has been added that will accept country names and
codes to filter queries
-- a country 'tag cloud' that can be primed prior to event queries has bee added
-- an exclude input box has been added so that you can pick away at
your query results
-- different property files can be used when creating link graphs
-- different split modes can be used when creating link graphs
-- canvas colour can be changed when creating link graphs
-- fixed protocol function to acknowledge unknown entries
-- fixed sorting problem with 'existing files' drop down
-- sensor selection now fully enumerates the sensor table and
(supported) agent types

## Pictures are here:

http://www.pintumbler.org/sq8

## More information is available here:

http://www.pintumbler.org/Code/squert

## You can download it here:

http://sourceforge.net/projects/squert/files/

Sourcefire doesn't make any official endorsement to projects surrounding Snort.

ThePigDoktah needs some feedback

One of the many OpenSource projects that surround Snort is a new one by JJ Cummings of Sourcefire, named "thepigdoktah".

This is a tool basically for parsing and generating some useful statistics out of the performance logs that Snort generates.

Analyzing for you, Mb/s successfully analyzed, dropped packets, packets per second, size of packets.  There are a lot of metics and statistics in the perfmon preprocessor files that Snort generates, and thepigdoktah aims to expose those to the user.

Take a look at the project here.

Help for Rule Writers or What's in that Buffer?

Ever wondered what the buffers look like inside of Snort?  Want to see what the preprocessors and decoders do to your traffic?

Take a look at this new post by kpyke of our Vulnerability Research Team (VRT) here at Sourcefire.  The post includes some great new example SO rules that you can use to really understand what is going on under the hood of Snort

http://blog.talosintel.com/2011/01/in-which-kpyke-looks-behind-green.html

RPMS for RHEL5 are available from the Community

Vincent Cojot, one of our Snort Community members has taken it upon himself to maintain the list of RHEL5 compatible RPMS and SRPMS in both i386 and x86_64 formats.  These include libpcap, daq, libdnet, and of course Snort itself (2.9.0.3).  DAQ and Snort 2.9.0.x will not work on RHEL5 because of the older libpcap libraries, so you will either have to compile your own libpcap, or use the RPMs below.

So if you are on RHEL5, and you want to upgrade to the latest and greatest version of Snort without compiling, see Vincent's RPMS.

Sourcefire, however, makes no endorsement of Vincent's RPMS or their contents.  Use at your own risk.  Sourcefire will always recommend that you download and compile Snort, from the source code, available at http://www.snort.org.

Take a look:
http://vscojot.free.fr/dist/snort/snort-2.9.0.3

Hopefully this will help those of you at RHEL5.

UPDATE:  We created a page at Snort.org to help you if needed.