Re-thinking Snort http rules

An invistigation Snort rules for HTTP lead to notice that Snort could be vunerable when attacker make use of HTTP tunneling. A good number of applications route their HTTP traffic through non HTTP_PORT i.e. application can use other port other than 80, 443 to send data.

looking at snort rules such as

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI dcforum.cgi access"; uricontent:"/dcforum.cgi"; nocase; flow:to_server; flags:a+; reference:bugtraq,2728; classtype:attempted-recon; sid:1000818; rev:5;)

it is clear that any url containing the word dcforum.cgi will generate an alert. However, using a p2p application for instance which uses port 5678 for HTTP traffic, the same traffic that would generate an alert on port 80.

Here is a record of P2P application and the ports number configured by default [http://www.securityfocus.com/infocus/1843]

Limewire 6346/6347 TCP/UDP
Morpheus 6346/6347 TCP/UDP
BearShare default 6346 TCP/UDP
Edonkey 4662/TCP
EMule 4662/TCP 4672/UDP
Bittorrent 6881-6889 TCP/UDP
WinMx 6699/TCP 6257/UDP

This actually suggest that relying on port 80 to identify HTTP traffic is not appropriate any more. Rather, it is time to search for HTTP request and response header [RFC21616].

When packets arrive at the network, a prior analysis of those packet should be made in other to identify which type of traffic is being received. Once the protocol is identified, then there is a good chance to give a more appropriate to the analysis to those packets.

As security is being tightened every day, hacker would be looking at more obvious ways to get into private data or execute malicious code. Giving that there are more and more P2P application becoming available for TV, Sport channel, Movies, and file sharing, it is important to focus on analysing P2P behaviour in terms of incoming traffic. Security expert should be aware that check ports number should be the least to do and should not represent any level of satisfaction as a security feature. default port could

Publish Post

be change by users if they are being targeted by security administrator. A deep analysis of packets is therefore inevitable.

Jules Pagna Disso