1

IDS such as snort uses string match or PCRE as basis for the rules. A string rule will only match one pattern, a PCRE rule can match a list of patterns.

I wonder if hackers can use palindrome to defeat PCRE based rules. palindrome are symmetric patterns such as abccba uvwwvu

Since palindrome patterns can't be expressed by PCRE rules, so it's going to be hard to write a snort rule to detect it, right?

2

The aim of a snort rule is not to match arbitrary content but potentially malicious content. A palindrom by itself is not malicious. And if you are able to construct a specific malicious palindrom then it is probably easy to match this one with a string or PCRE match.

  • Thx for the quick reply. You made me realized that malware author doesn't even need to use palindrom to achieve this. They just need to do some simple encoding like: given a string x (to be send in URL), randomly pick a character y, do XOR of y and every characters of x, to form a new string x1, then base64 encode x1 to create a new string z, they send the string y+z (concatenation) in URL. It's easy to do decoding. It's very hard for snort to match against this type of URLs, is that right? – packetie Aug 7 '16 at 15:33
  • @user36712: pattern matching can not deal with obfuscated or mutating payload encoding. But without a decoder this payload is not malicious at all. Thus it might be possible to create a rule which matches the decoder part of the payload. – Steffen Ullrich Aug 7 '16 at 15:42
  • That's a good thought, but It seems that the decoder in the contrived sample encoding in earlier comment can't be detected by a snort rule. What do you think? – packetie Aug 7 '16 at 16:26
  • @user36712: there is no code for a decoder, just a description. If you write the actual code for it one could write a signature. But in general static signatures like used in snort and other IDS are not able to deal when the decoder mutates too all the time. At the end IDS is just a way to deal with the easy things fast but cannot handle more complex attacks. – Steffen Ullrich Aug 7 '16 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.