Re: Polymorphic Shellcode detection

From: David Barroso <dbarroso(at)s21sec.com>
Date: Tue May 06 2003 - 17:13:11 EDT

> Hi,
> i wanted to find if the present ids'es are able to detect

The fnord prepocessor (was included in snort) says: This has proven to be substantially better than the snort experimental NOP signatures with fewer falses, and consumes very little CPU in testing on a
loaded DS3. Beta testing has caught some new attacks using this detector and
shown that turned up to high sensitivity levels it functions as a good lycos cookie, nntp, and streaming media detector too :-).

It should detect any ordinary shellcode that has NOP sleds even it it is not polymorphically mutated, as well as codes mutated with K2's ADMmutate.

---

Grupo S21Sec Gestión S.A.

---

Can you respond to attacks based on attack type, severity, source IP, destination IP, number of times attacked, or the time of day an attack occurs? No?
No wonder why you're swamped with false positives! Download a free 15-day trial of Border Guard and watch your false positives disappear.

http://www.securityfocus.com/StillSecure-focus-ids2

---

Received on Tue May 6 17:20:11 2003