full-disclosure - Re: Apache Killer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 25 Aug 2011 20:09:23 -0500
From: David <dchurch@...el.net>
To: Marco Ermini <marco.ermini@...il.com>
Cc: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Apache Killer

To be clear, that is just to simply know your under attack? There is nothing you can do about it yet?

On Aug 25, 2011, at 11:57 AM, Marco Ermini <marco.ermini@...il.com> wrote:

> On 24 August 2011 16:23, ZOne wrote:
>> For those using Snort, a local snort rule to alert for incoming attacks
>> might help while waiting for a patch.
>> 
>> example:
>> 
>> alert tcp $EXTERNAL_NET any -> any 80 (msg:"INBOUND Apache Killer script:
>> Local web server is under attack."; content:"Range:bytes=0-"; classtype:
>> denial-of-service; threshold: type threshold, track by_src, count 5 ,
>> seconds 20; sid:3000005;)
> 
> For those using Snort, you should take care that this rule is very
> easy to break: it just detects a string "Range:bytes=0-" inside of TCP
> packets sent to port 80, sent five times in twenty second by the same
> IP.
> 
> That is very easy to avoid, just using a different initial byte than
> zero, putting a space between "Range:" and "bytes", or changing the
> threshold. Basically it is violating rule 1 of IDS signature writing,
> "patch the vulnerability, not the exploit" - as just changing the
> exploit as little as a single space will not make it work.
> 
> I did instead the following:
> 
> alert tcp any any -> any $HTTP_PORTS ( \
> content: "Range"; nocase; http_header; \
> pcre:"/(\d\,){6,}/xH"; http_header; \
> msg:"Apache DOS http://seclists.org/fulldisclosure/2011/Aug/175"; \
> reference:cve,2011-3192 )
> 
> However this is certainly not the best possible as I am no Snort rules
> guru. Also I have not tested it.
> Another one possibly faster, can be something like the following
> (again I have not tested it):
> 
> pcre: "/^Range:bytes\s+\d+-\d?,\d+-\d+,\d+-\d+,\d+-\d+,\d+-\d+,\d+-\d+,/xH";
> http_header; \
> 
> 
> Cheers
> -- 
> Marco Ermini
> root@...an # mount -t life -o ro /dev/dna /genetic/research
> http://www.linkedin.com/in/marcoermini
> "Jesus saves... but Buddha makes incremental back-ups!"
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/