Slashdot Mirror
New Location For (Bleeding-Edge) Snort Sigs
Vantage writes "A few of us have gotten together and built a snort 'signature repository.' ... This is a place for everyone to post their personal and company-made signatures and to take a look at and use those submitted by others. It is by no means a replacement for the snort.org signature base, but it will help to get signatures out there for brand new vulnerabilities. We are hoping that those snort users in the /. community will add there sigs to this database. We are looking to add any and all signatures herem so please feel free to post all of your sigs."
Maybe it's just me, but isn't the link pointing at a raw phpbb2 install with very very little customizaiton?
Is this just a forum for posting stuff, with the concept being "post snort sigs here asap"?
Why would anyone anywhere use this? you lose all the potential that the concept has by slamming it into a generic system. Why not create a db system that has various intrusion characteristics as bools, and you can attach a sig to a textual report with flagged characteristics, and then let admins and such search the db by characteristic or description text, or affected apps/protocols, etc. Other admins could hit a "have seen in wild" button to let the site rank various intrusion techniques by how common they are.. There is a lot of potential, and it is all squandered. Back to the drawing board.
That's like, what, a five click install process? No offense, but it doesn't strike me as the ideal software for doing this, let alone hard to set up. You haven't even customised it. You haven't even bought a domain name for this site. It's an interesting idea, but you really need to work on your web marketing skills. But it won't matter, since on a shared server with a MySQL backend I expect the site will be /.ed in about T-minus five minutes.
See who will be the first to hack the site:
config.php
it's so bleeding edge, there's no time to set things up! hurry!
Well we are working on other options this seamed like the easiest and fastest way to get the idea off the ground... Does anyone have any software suggestions... Other than slashcode?? We are looking at CVS....
I thought cigs were something you smoked, not something you snorted!
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
The Open Source Network Intrusion Detection System
Doesn't snort.org keep a public repository of Snort signatures? I am pretty sure anyone can make a submission to their set of rules. It's open-source software, rather than forking rules elsewhere they should be submitted to the sourceforge group (so they can be corrected, improved, built into the software as preprocessors and so on). Maybe I am misunderstanding something. I don't really understand the point of doing this.
I maintain 3 snort servers. Most of my snort rules are very uninteresting, and are used in limiting alerts, and getting rid of false positives due to limited computer resources. We cannot afford to have 10,000 or more alerts per day. The most interesting thing I have written for snort is a simple update utility that gets new rules every 24 hours.
Just my 2 cents.
/^([Ss]ame [Bb]at (time, |channel.)){2}$/
You're thinking of Snarf
If you like submit the update utility... I use oinkmaster and have had good luck but if someone has another option... it would be interesting to look at.
As for the reasoning behind this. I have debated this with dozens of people in the last week. Snort.org and the sourceforge snort list are great resources.. but few people submit things that they think are only good for there INTERNAL use and nothing makes it into the signature-base until it gets approved... in my instalation and in others there is a need for a good source of sigs for exploits that have JUST been released. Snort.org doesnt want to, and I agree with them, start releasing untested signatures... They do an increadable job. I, and several others, wanted a place we could put our signatures for brand new stuff. so we each didnt have to write a new signature while we were waiting for the "official" sig to be released into the snort sig-base. This place give us a place to submit our sigs and use each others and it allows us to cut down on the maintenance time that we spend on our snort installs. It is a usefull place for us and I hope it becomes a usefull place for others in our situation.
As for your rules being uninteresting... I bet there is someone out there that would find them handy... Its not like it is hard to post them... and maybe someone can use them... I say post what you have... it cant hurt and it might help someone out!!