Hacking Team & pfSense

n3by

Something interesting to watch:

https://youtu.be/4BTTiWkdT8Q

Guest

They need to come out with a version of Windows called Zero Day and spin it in some good way…

kejianshi

Windows issues tons of Zero-Day updates… sooooooo....

jimp

@Phishfry:

They need to come out with a version of Windows called Zero Day and spin it in some good way…

They're about to come out with Windows one-zero (day). :-)

The "day" is silent…

n3by

I found this Snort rule for detecting Adobe exploit from Rook Security:
https://www.rooksecurity.com/hacking-team-malware-detection-utility/

alert tcp $EXTERNAL_NET any >
$HOME_NET any (msg:"CVE20155122:
Adobe Flash Exploit (Memory Corruption)";
flow:from_server,established; content:"|43 57 53|"; content:"|c9 66
3d 21 24 49 68 69 69 39 12 61 04 4a 49 4e|"; offset:127; sid:9931892;
rev:2;

anybody can post a link ( or make a quick one ) to a tutorial how to add this custom rule in Snort / Suricata ?

thank you.

Supermule

Update your Snort ET rules and see if its there before the custom add…

n3by

It is updated and I can't find it… or I don't know where to find it...
Here is the update log:

Starting rules update...  Time: 2015-07-24 14:05:00
	Downloading Snort VRT rules md5 file snortrules-snapshot-2973.tar.gz.md5...
	Checking Snort VRT rules md5 file...
	Snort VRT rules are up to date.
	Downloading Snort OpenAppID detectors md5 file snort-openappid.tar.gz.md5...
	Checking Snort OpenAppID detectors md5 file...
	Snort OpenAppID detectors are up to date.
	Downloading Snort GPLv2 Community Rules md5 file community-rules.tar.gz.md5...
	Checking Snort GPLv2 Community Rules md5 file...
	There is a new set of Snort GPLv2 Community Rules posted.
	Downloading file 'community-rules.tar.gz'...
	Done downloading rules file.
	Downloading Emerging Threats Open rules md5 file emerging.rules.tar.gz.md5...
	Checking Emerging Threats Open rules md5 file...
	Emerging Threats Open rules are up to date.
	Extracting and installing Snort GPLv2 Community Rules...
	Installation of Snort GPLv2 Community Rules completed.
	Copying new config and map files...
	Updating rules configuration for: WAN ...
	Restarting Snort to activate the new set of rules...
	Snort has restarted with your new set of rules.
The Rules update has finished.  Time: 2015-07-24 14:06:03

Any way if I try to add this rule to Snort - custom:

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2015-5122: Adobe Flash Exploit (Memory Corruption)"; flow:from_server,established; content:"|43 57 53|"; content:"|c9 66 3d 21 24 49 68 69 69 39 12 61 04 4a 49 4e|"; offset:127; sid:9931892; rev:2;)

I get this error:

The following input errors were detected:

    Custom rules have errors: Fatal Error, Quitting..ERROR: /usr/pbi/snort-amd64/etc/snort/snort_31348_rl0/rules/custom.rules(1) Illegal direction specifier: ->

anybody can debug and correct ?

thank you.

n3by

that one worked finally:

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2015-5122 Adobe Flash Exploit Memory Corruption"; flow:from_server,established; content:"|43 57 53|"; content:"|c9 66 3d 21 24 49 68 69 69 39 12 61 04 4a 49 4e|"; offset:127; sid:9931892; rev:2;)

any idea how to quick search for SID nr to find/check for duplicate ?

Supermule

Maybe its a UX improvement to the Snort package that Bill could undertake??

Mr. Jingles

@n3by:

that one worked finally:

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2015-5122 Adobe Flash Exploit Memory Corruption"; flow:from_server,established; content:"|43 57 53|"; content:"|c9 66 3d 21 24 49 68 69 69 39 12 61 04 4a 49 4e|"; offset:127; sid:9931892; rev:2;)

any idea how to quick search for SID nr to find/check for duplicate ?

Thanks. I added it to my WAN interface as a custom rule (that is: I think I did, I simply pasted it in the 'custom rules' screen; would you know how you actually enable this rule? The 'custom rules' screen is way different than the screens for the other rule sections. (just a big text field, not the usual table view with records).

kejianshi

What were we talking about again? I've lost track…

shaqan

@n3by:

Lots of governments ( even in EU - ex communist countries ) that have complete control over secret services already have this kind of sw bought, stolen or developed by their experts and they target the whole computer or infrastructure ( LAN, Forums… ) and not only one target user.

I noticed that Snort has rules for FinFisher/FinSpy. Bunch of government's "services" (also in EU) are reportedly using it.