Re: [Full-disclosure] Apache Killer

[David <dchurch@xxxxxxxxx>]

To be clear, that is just to simply know your under attack? There is nothing 
you can do about it yet?

On Aug 25, 2011, at 11:57 AM, Marco Ermini <marco.ermini@xxxxxxxxx> wrote:

> On 24 August 2011 16:23, ZOne wrote:
>> For those using Snort, a local snort rule to alert for incoming attacks
>> might help while waiting for a patch.
>> 
>> example:
>> 
>> alert tcp $EXTERNAL_NET any -> any 80 (msg:"INBOUND Apache Killer script:
>> Local web server is under attack."; content:"Range:bytes=0-"; classtype:
>> denial-of-service; threshold: type threshold, track by_src, count 5 ,
>> seconds 20; sid:3000005;)
> 
> For those using Snort, you should take care that this rule is very
> easy to break: it just detects a string "Range:bytes=0-" inside of TCP
> packets sent to port 80, sent five times in twenty second by the same
> IP.
> 
> That is very easy to avoid, just using a different initial byte than
> zero, putting a space between "Range:" and "bytes", or changing the
> threshold. Basically it is violating rule 1 of IDS signature writing,
> "patch the vulnerability, not the exploit" - as just changing the
> exploit as little as a single space will not make it work.
> 
> I did instead the following:
> 
> alert tcp any any -> any $HTTP_PORTS ( \
> content: "Range"; nocase; http_header; \
> pcre:"/(\d\,){6,}/xH"; http_header; \
> msg:"Apache DOS http://seclists.org/fulldisclosure/2011/Aug/175";; \
> reference:cve,2011-3192 )
> 
> However this is certainly not the best possible as I am no Snort rules
> guru. Also I have not tested it.
> Another one possibly faster, can be something like the following
> (again I have not tested it):
> 
> pcre: "/^Range:bytes\s+\d+-\d?,\d+-\d+,\d+-\d+,\d+-\d+,\d+-\d+,\d+-\d+,/xH";
> http_header; \
> 
> 
> Cheers
> -- 
> Marco Ermini
> root@human # mount -t life -o ro /dev/dna /genetic/research
> http://www.linkedin.com/in/marcoermini
> "Jesus saves... but Buddha makes incremental back-ups!"
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/