Snort Package - Enable Flash & PDF decompression

kevross33

Hi,

As of Snort version 2.9.7.0 the HTTP pre-processor has allowed for decompression of flash and PDF files for better analysis of these. I noticed however that these options however do not seem to be enabled in the snort pfsense package and given the preference for exploit kits to currently use flash it would be useful if these options were enabled by default.

http://blog.snort.org/2014/10/snort-297-has-been-released.html
"The HTTP Inspection preprocessor now has the ability to decompress
DEFLATE and LZMA compressed flash content and DEFLATE compressed PDF
content from http responses when configured with the new
decompress_swf and decompress_pdf options. This enhancement can be
used with existing rule options that already match against
decompressed equivalents."

Current Settings
post_depth -1
max_headers 0
max_header_length 0
max_spaces 0
enable_xff
enable_cookie
normalize_cookies
normalize_headers
normalize_utf
extended_response_inspection
inspect_gzip
unlimited_decompress
normalize_javascript
max_javascript_whitespaces 200
log_uri
log_hostname

Would need these added in:
decompress_swf
decompress_pdf

Thank you very much for providing this :)

Kind Regards,
Kevin Ross

bmeeks

Thanks for the heads-up. I will add these new options in the next Snort update.

Bill

kevross33

Great, thanks. Just so you are aware it does require liblzma during compile for this option to work.

bmeeks

These two options will be available in the next Snort update which I'm working on now. Should be ready in a few days. The options will be included as part of the HTTP_INSPECT window that opens when you edit an HTTP Server configuration from the PREPROCESSORS tab.

Bill

jeffhammett

@bmeeks:

These two options will be available in the next Snort update which I'm working on now. Should be ready in a few days. The options will be included as part of the HTTP_INSPECT window that opens when you edit an HTTP Server configuration from the PREPROCESSORS tab.

Bill

Thanks! One question, why leave these options unchecked by default? Is it due to potential performance hits or is there something else that should be considered before enabling?

bmeeks

@jeffh:

@bmeeks:

These two options will be available in the next Snort update which I'm working on now. Should be ready in a few days. The options will be included as part of the HTTP_INSPECT window that opens when you edit an HTTP Server configuration from the PREPROCESSORS tab.

Bill

Thanks! One question, why leave these options unchecked by default? Is it due to potential performance hits or is there something else that should be considered before enabling?

No particular reason other than since they were never there before, they were sort of by default "unchecked". In retrospect I probably should have defaulted them to "checked" and will do so in the next update.

Bill