CheckPoint Acquires Snort

bobdehnhardt writes "The Snort-announce list was burning with the news that CheckPoint has signed an agreement to acquire Sourcefire, the commercial arm of the Snort community. As part of the agreement, CheckPoint will "continue to develop and distribute Snort under the GPL, improve and document the program to stay on the cutting edge and expand the snort.org web site." Here is a message from Snort creator Marty Roesch."

Comments

SnortFIRST

[Anonymous Coward]

best.Tool.Ever.

Hope this does not compromise the GPL nature of this fantasitic project.

Re:SnortFIRST

[Puttu001]

The GPL nature will be gone soon. Checkpoint is one such a company where everything is their own standard and as others suggest it they will soon fork their own version.

Re:SnortFIRST

[Philip K Dickhead]

Snort will backdoor/forward everything to MOSSAD now. The Israelis will be conveniently dropped from detection.

Fork or be F**ked.

" Here is a message from Snort creator Marty Roesc

[b1gk1tty]

" Here is a message from Snort creator Marty Roesch."

I'm rich I'm rich I'm filthy f*ckin rich!

Mob Appeal

[Anonymous Coward]

"CheckPoint Acquires Snort"

That's OK. The Mob aquires "Inject".

while snort is a fine piece of software ...

[Anonymous Coward]

I think its usefulness is very limited.

It is nice to know I am protecting/monitoring my LAN from KNOWN attacks,
is does very little to stop a determined attacker who can write
their own shellcode and exploits.

Which, if you hop on IRC now days, represents quite a few attackers.
The people we made fun of long ago have aquired the skills to get around
snort rather easily.

So, rest at night, thinking you have protected your lan, while in reality
you have not.

Re:while snort is a fine piece of software ...

[j_kenpo]

Which is why you run Snort with full packet logging mode in addition to alert mode. This way, if an alert is missed, you can still see all packets sent in an attack and build an alert from that. Just make sure you have enough storage space.

Re:while snort is a fine piece of software ...

[b0r1s]

It's worth mentioning that it's possible to trigger on known attack VECTORS rather than just known attacks - that is, on some vulnerabilities, all possible attacks will have a single signature at some point in the packet, which WILL be triggered. Moreover, some PROTOCOLS will always have the same signature, which may be hit as byproducts of the attack (ie: if I see an IRC packet coming from a webserver, I'm going to alert no matter what port it's on, or where it's going, because it shouldn't be there, period).

Snort can be bypassed in many scenarios, but it's still very useful.

Re:while snort is a fine piece of software ...

[PGillingwater]

Plus you might find that a shellcode exploit requires a shellcode sled, which can be detected. And many of the people who use Snort might not know that Sourcefire has made a major innovation with RNA -- a passive traffic analysis system which tells you what hosts are in your LAN, and what ports are being used -- kind of like NTOP, but with better consolidation and reporting.

Re:while snort is a fine piece of software ...

[Anonymous Coward]

Actually, Snort, and any other IDS, doesn't protect shit. It tells you that you've been compromised if (as you correctly point out) the attacker uses a known exploit or snort detects shell code, etc. What do you do at that point? Flatten and rebuild of course. So, you aren't preventing anything, you are detecting.

What this acquisition promises is a snort based IPS - add snort rules to a checkpoint and drop the offending packets, don't just log them and let them go on their merry way.

Re:while snort is a fine piece of software ...

[kc0re]

This is the way the Snort rules from the VRT are designed. To look for the Vector (the vulnerability) instead of the exploit. An exploit can be coded a hundred different ways (let's just say for arguements sake) The vulnerability (theoretically) can be had at 1 way.

Re:while snort is a fine piece of software ...

[energylad]

It's unfortunate that Sourcefire's licensing doesn't let you model the hosts on your LAN, only as many IPs as you paid for (and it's quite dear).

For something with only limited ability to peer into packets, limited stream reconstruction (too expensive, CPU-wise, for most platforms), and virtually no application-level protocol understanding -- not to mention zero insight into firewall evasion techniques like HTTP tunneling -- it's an extremely limited solution for something that can't even tell you write a policy about what should be allowed in the first place.

Anything that:

* simply accepts what your network is doing as "baseline" without any thought to security best practices,
* doesn't give you anything more than a limited version of 2001-era layer-3 visibility into your traffic --
* and tacks on a terrible enterprise-wide management and aggregation console and no role-based access across security zones ... isn't really worth the trouble to deploy.

But man, aren't those 3D graphs cool? They don't mean anything, but wow.

Patrick Dennis

PS Reminds me of something I saw on a Navy base back in 2002. Some guys in the NOC were talking about this cool solution they'd bought, Silent Runner (long since bought by CA and vanished, like all such things).

"It's got this awesome visualizer," the guy said. "It's a headset you put on, and there's a dedicated SGI box that gives you a stereo image of what your network's doing. It's cyberspace for real, I'm telling you. And it puts a little rotating 'skull and crossbones' over bad hosts, so you can see when a Chinese hacker is coming in at you."

"That's really cool! I'd love to see it. Can I try it out?"

"Aw," he said, jerking a thumb over his shoulder, "it's in the closet somewhere."

Re:while snort is a fine piece of software ...

[acid_zebra]

Aside from the fact that Snort rules get updated very quickly when a new 'sploit is making the rounds, what's with the all-or-nothing angle?

Snort can be a useful item in your toolkit, adding to your protection as a WHOLE.

Re:while snort is a fine piece of software ...

[MadMidnightBomber]

Snort doesn't only alert on known exploit payloads, it looks for malformed data which could trigger the bugs in the first place. It also has a load of stuff for monitoring port scanning. On this University class B, it is a really invaluable tool. Which is not to say that you don't need to think about using other things to protect your network.

Sourcefire's official slogan isn't "Snort - pulling people's arses out of the fire since 1998", but it should be.

Re:while snort is a fine piece of software ...

[slash-tard]

Check point already has some "smart defense" features that try to do this. Its basically crap in my opinion. I dont want random firewall drops on ports I decide to allow because the software is trying to be smart. With a lot of improvement it could be useful though.

Re:while snort is a fine piece of software ...

[alexandreracine]

yeah, but this is a REactive mode, and not PROactive.

Re:while snort is a fine piece of software ...

[jnf]

Really? I tend to make my nop's some variation of 'HIYOUDONTKNOWWHATYOUARETALKINGABOUT' or 'AAAAAAAAAHCERTIFICATIONSMEANNOTHING' or 'ILUBYOUINTERNETS', which depending on the platform are very valid opcodes, care to explain to me how exactly you will catch that?

Additionally, I am not the exception, its just that the security industry is full of people who haven't ever actually done much more than believe whatever metasploit told them, so they just don't know how easy it is to sidestep all of their signature detections.. Especially when it comes to shellcode detection.

Re:while snort is a fine piece of software ...

[pboulang]

You're suggesting what, that the fight should be taken to IRC? How else can you be except reactive? You cannot anticipate all attacks, but you sure as heck can implement a "once bitten twice shy" methodology.

Seriously, why are you complaining about watching packets to look for anomolies? What is your take?

Re:while snort is a fine piece of software ...

[pboulang]

You don't get it, there appears to be a gap in the fossil record, because there are no bones for a 75,000 year period a million years ago. Obviously, evolution can't work, Intelligent design must be taught in schools.

To answer your question, because these people are morons. You are obviously browsing the wrong site with that attitude of careful analysis.

Re:while snort is a fine piece of software ...

[kc0re]

No, but we have T-Shirt that say "SNORT, saved my bacon..." -- Sourcefire Employee

Loopholes

[diogenesx]

Even with such language, does that stop them from forking the sources and creating a new closed source program with a new name?

Re:Loopholes

[Afecks]

Even with such language, does that stop them from forking the sources and creating a new closed source program with a new name?

Read the GPL...it stops them from doing exactly that.

Re:Loopholes

[Anonymous Coward]

Not if they own the copyright (which I'm not sure about in this case).

Re:Loopholes

[monkeydo]

No, it doesn't. The owner of the copyright can stop releasing new versions under the GPL. Any code already licensed under the GPL would remain so, but nothing stops them from making all new versions closed, or something in between.

Re:Loopholes

[0racle]

You might want to look into something called dual-licensing. The owner of the copyright can do whatever they please with what they own.

Re:Loopholes

[FidelCatsro]

Unless they accepted patches from a third party not directly involved in the project , They would need to track down each and every person that had (and acquire their blessing) or each and every code snippet and remove it .
This is the same problem which faces the linux Kernel if they wished to move it to the GPL3

Re:Loopholes

[temojen]

Except having to chase down every person who ever submitted code, to ask for permission.

Re:Loopholes

[Afecks]

They aren't the owner, neither is Sourcefire, Martin Roesch is. According to the FAQ, they are buying the Sourcefire company, not his copyright.

Re:Loopholes

[sgml4kids]

Nor does anything stop them from directing ongoing snort development to being a "tier B" solution (intentionally degrading the effectiveness or performance of snort) relative to their proprietary "tier A" solutions. Lots of companies do this -- they sell the same product: fully enabled at a premium prices, and partially disabled at a lower price. Many companies manfuacture the generic non-brand products "competing" with their own brands (eg. drug companies). If two products compete with each other, it's a bonus if you own both of them.

It may be a smart business move and the shareholders/owners of Checkpoint(TM) probably expect them to do whatever is necessary to maximize profits.

Two thumbs down for this move.

Re:Loopholes

[Afecks]

I repeat: They aren't the owner, neither is Sourcefire, Martin Roesch is. According to the FAQ, they are buying the Sourcefire company, not his copyright.

Re:Loopholes

[at_slashdot]

"They aren't the owner, neither is Sourcefire, Martin Roesch is."

I doubt he is the owner either. Once you GPLed your software and people added to it you no longer own the software and can't impose restrictions anymore since you'd infinge the rights of the contributors.

Re:Loopholes

[Anonymous Coward]

This is what has happened with Newt, which is a closed-source Windows port of the Nessus server, written by the author Renaud Derraison. Apparently all the plugin authors aren't bothered by a closed-source fork of their work. Fortunately someone's released a Windows port of the existing GPL'd source tree; I doubt those patches are being folded into the main source tree, though, and I don't know whether it's being actively maintained. I don't want to deny Renaud the means the make a living using his work, and he certainly has a moral right to do this, but I don't think it's compatible with the SPIRIT of the GPL.

Letter Text

[Kiashien]

Interesting. Snort looks like a pretty cool tool. Anyone know more about it? How does it hold up against other intrusion detection packages?

And, any info on check point? I've heard of them, but haven't really seen much about their products.. then again, I code mainly, don't see much of the network admin side of IT. I try to keep up though.

Oh.. and since Snort.org looks like its flying toward slashdotted.. it barely loaded. Here's the letter.

------
October 6, 2005

To the Snort community:

I am very excited to announce that Check Point has signed an agreement to acquire Sourcefire, the company that develops the Snort® project and maintains the snort.org domain. I know that many of you are probably going to ask "what does this mean for Snort?", so I'd like to take a few minutes to talk about that.

I'll start by stating again what I've stated in the past, Snort is now and will continue to be free to end-users. We will continue to develop and distribute the Snort engine under the GPL, improve and document the program to stay on the cutting edge and expand the snort.org web site. The community continues, as always, to be important to us as a group of people who use the code pervasively throughout the entire Internet, report on problems and make suggestions and contributions to the project. Check Point is very excited about continuing Sourcefire's involvement with the open source community!

I'd also like to take a moment to extend a personal "thank you" to the Snort community for your contribution to Sourcefire's success. Little did I know when I first decided to GPL and release Snort in 1998 that it would become the foundation of this worldwide community of hundreds of thousands of users and the core technology of Sourcefire at its founding, and now the launching point for an acquisition by one of the largest and most respected security companies in the world. All of us at Sourcefire look forward to taking our vision and technology to the next level as a vital part of a true industry leader and continuing to build the best open source intrusion detection and prevention technology in the world.

The acquisition is subject to regulatory conditions and approvals and is expected to close by Q106. You can review the press release and FAQ documents at http://www.checkpoint.com/sourcefire.

Sincerely,

Martin Roesch
Founder and CTO
Sourcefire, Inc.

-----

Re:Letter Text

[Anonymous Coward]

www.snort.org. It's a very nice tool, very widely used. Many companies would rather pay big bucks for something, but for a lot of people, Snort does a very good job. As anyone who has worked with IDS knows though, the amount on the tin doesn't really matter, it's all about how much you can afford to dedicate to ongoing management of it. Snort+Acid is pretty good for managing alerts.

www.checkpoint.com. Used by 100% of Fortune 100 companies. I know, I know, people will talk about how much they dislike it, and to be fair, it used to be pretty crap. Most people who bitch about probably last saw it circa 4.1. That came out years ago, and it shows. R55 onwards is very nice, and runs very well. NGX has got some pretty good stuff, but it's too early for serious deployment. I'd like to deploy it, but it's just too high a risk. Those who have already done it obviously evaluate their risks differently.

People around here will go on about how great {Linux/BSD}+{iptables/pf/whatever) are, and for simple setups they're probably right. However, once you have to manage large numbers of systems, in a distributed environment, you really start to appreciate Check Point's management setup. Makes Cisco's management story look like a joke.

As for the other poster talking about lack of support for Linux...well all I can say is that they haven't been following the SecurePlatform developments. There's a lot more to firewalls than a desktop client. I haven't tried it myself, but if I can get my Mac to connect to a Check Point firewall using IPSecuritas, I would imagine it's not too difficult to do with Linux. Although, yes a remote access client would be nice, at least for a kernel version from this century.

One last thing - as someone else said, Check Point support bites. I have heard it's improving, but I haven't logged any calls for a while, so I can't say.

Re:Letter Text

[kc0re]

Interesting. Snort looks like a pretty cool tool. Anyone know more about it? How does it hold up against other intrusion detection packages?

Snort is the most widely used IDS in the world today. > 2,000,000 downloads. It beats every competitor, Cisco, ISS, McAfee, 3COM. Rated #1 by SC Magazine.. etc..etc..etc..

More info from Checkpoint

[Parid]

Here is some more info from checkpoint including a FAQ.
http://www.checkpoint.com/sourcefire/

I use both firewall-1 and sourcefire currently. The one thing I hope they /don't/ do is merge the two support teams. Sourcefire's support is decent, but checkpoints is down right awful.

Re:More info from Checkpoint

[monkeydo]

Since when does copying a link from the article summary qualify as "more information" and get modded informative?

Re:More info from Checkpoint

[krinsh]

Amen to that. I'm not overly fond of FW-1 but it does its job.

SourceFire does not *sell Snort*, rather they sell master/slave appliances for enterprise IDS and also a passive network scanner called RNA; which can be integrated with other IDS products and SIMs such as netForensics. The SourceFire NIDS is Snort based. I heard from a former coworker (and security engineer) that SourceFire was about to come out with a complete rewrite of its appliance software and more automated methods for updating signature sets; as a former security type I think that would make large installations a lot easier to handle. I hope the stuff will stay a separate product and not just get absorbed by CheckPoint.

Does that mean the folks in Columbia, MD have to move to Israel? (just kidding)

Re:More info from Checkpoint

[Flower]

It may be because of the discussion of support rather than the link..... More mods have been done over less content.

Checkpoint and Linux

[Anonymous Coward]

Checkpoint are not known for being too interested in providing versions of their software for Linux. Lack of a current Linux checkpoint vpn client is all that's keeping me running a (gack) Windows machine in my home..

Soooo.... is Checkpoint Snort going to go Windows-only??

Then again, maybe this heralds a new era of cooperation between Checkpoint and the non-Windows world.

Re:Checkpoint and Linux

[mpathetiq]

Checkpoint built their own version of Linux called SecurePlatform specifically for running their firewall, management tools, and other software. Quite often, the GUI and end user tools only ran on Windows, but the real meat-and-potatoes was usually supported on Linux.

Re:Checkpoint and Linux

[kotj.mf]

Indeed. It's also theoretically possible to use FreeS/WAN and OpenS/WAN as a VPN client.

Unfortunately, though, the SmartWhatever management console is Windows-only, and it doesn't really work in WINE. I suppose it'd be possible to edit the policies by hand, but the prospect of doing that is pretty frightening. Hence, the crufty old 2K box on my KVM switch.

Re:Checkpoint and Linux

[mpathetiq]

'Tis true about Free/OpenS/WAN. I had to set up a few site-to-site connections between various incarnations of Firewall-1 and small Linux boxen in my prior life as a consultant.

Re:Checkpoint and Linux

[Anonymous Coward]

Their GUI apps, and even their VPN client, works quite well in VMware.

Re:Checkpoint and Linux

[mseeger]

Hi,

we evaluated the SSL network extender and it worked fine with Linux. It's not a full flavored SecureClient but will suffice for most uses.

Regards, Martin

Re:Checkpoint and Linux

[clymere]

My solution was to run SmartDashboard within win2k in Vmware in Linux. If you sprung for Checkpoint, Vmware is peanuts. And of course there is qemu, which has worked wonderfully for me so far, although i haven't tried Checkpoint stuff in it as of yet.

Re:Checkpoint and Linux

[kotj.mf]

If you sprung for Checkpoint, Vmware is peanuts.

Ha. I know it, and you know it, but try telling it to my boss. I just count myself lucky that I'm allowed to run anything I want on my workstation.

Unfortunately, Win2k was pretty sketchy on qemu last time I checked, and I really didn't have the time to fuck with it, which is why I commandeered an old Windows machine.

Gone...

[Anonymous Coward]

Article is Slashdotted. Here it is atmirrordot.

makes sense

[spurious cowherd]

"We believe Sourcefire has world-class solutions for internal security through their Intrusion Sensor, Real-time Network Awareness (RNA), and Defense Center product lines.

Checkpoint needs this type of network awareness technology to keep up with Cisco
I know they lost my company's contract because the network admins like the way Cisco stuff integrates

I'll start by stating again what I've stated in the past, Snort is now and will continue to be free to end-users. We will continue to develop and distribute the Snort engine under the GPL, improve and document the program to stay on the cutting edge and expand the snort.org web site. The community continues, as always, to be important to us as a group of people who use the code pervasively throughout the entire Internet, report on problems and make suggestions and contributions to the project.

This is critical to me for many reason. It's good to see. Marty is a man of integrity & I'll bet this is in the aquisition contract

Check Point to acquire privately held Sourcefire for a total consideration of approximately $225 million.

Who says you can't make money from FOSS?
Marty deserves the fiduciary rewards he'll get for all his hard work over the years

Snort.org

[marcantonio]

Wow, it's been a while since I've been to the Snort website. It got very corporatey professional looking.

Snort... hrmm

[Lucractius]

So CheckPoint is Snorting now is it... Do the cops now, have the DEA been called in to raid their offices.

Re:Snort... hrmm

[Anonymous Coward]

That wasn't funny at all. I say that was a very poor attempt on your part. And your sig is stupid. Stop stealing from Adam.

Re:Snort... hrmm

[Lucractius]

I posted that before passing out at 3am after a long day at work, clearly its not my best work, and hm, i think saying i should properly quote the line in my sig is more polite than saying im deliberatly stealing it and its stupid.

No no no!

[Anonymous Coward]

CheckPoint Snorts SourceFire.

Snort is still an open source project.

Re:" Here is a message from Snort creator Marty Ro

[Stephen Samuel]

I can hear this loud sniffing sound coming from.....

(not that I'd suggest that Marty uses cocaine, just that his company is being snorted up, so to speak)

Umm

[temojen]

Since most attacks are based on known techniques, it can detect a lot of new attacks, such as anything that includes:

(lots of nulls)

const char * what = "/bin/sh";

where: push what;
push EXEC;
call syscall;

(some junk)
&where

On a whole lot of architectures, regardless of port. Which means it catches just about any stack-smashing attack that's not SSL encapsulated, regardless of service and whether it's known.

Re:Umm

[Anonymous Coward]

The problem is some of those rules would choke the snort rules engine. Rules that look for nulls are the slowest rules to be processed by Snort and fuzzy patern matching is pretty bad too. When the engine starts getting overwhelmed packets get by without being scanned and potential attacks can sneak through; so if you're not careful with your rules you might as well not be running Snort at all. To say that Snort rule tweaking is a very complicated art would be an understatement.

Re:Umm

[jnf]

const char *whawhat = "//bin/../bin//sh"; push SYSCALLOPCODE jmp esp for(i = 0; i bsize/2; i+=strlen("HILOOKTHISCANBEANOPTOO")); ... xor? Etc. your premise that it can catch just about any stack-smashing attack thats not SSL encapsulated is simply foolish. Snort only catches the people stupid enough to think that they can get away with copy/pasting someone elses shellcode from the 90's.

Re:Umm

[jnf]

(sorry i shouldve previewed ;[)
const char *whawhat = "//bin/../bin//sh";

push SYSCALLOPCODE
jmp esp

for(i = 0; i bsize/2; i+=strlen("HILOOKTHISCANBEANOPTOO")); ...

xor?

Etc.

your premise that it can catch just about any stack-smashing attack thats not SSL encapsulated is simply foolish. Snort only catches the people stupid enough to think that they can get away with copy/pasting someone elses shellcode from the 90's.

Re:Umm

[Anonymous Coward]

Most attackers do more or less copy and paste someone else's shellcode, only making minor modifications if they modify it at all.

Re:Umm

[jnf]

I guess I work in a different world than you.

makes money.

[Anonymous Coward]

"Who says you can't make money from FOSS?"

Who says you can't make money blogging?

Oh no!

[wootest]

Does that mean my father will have to pay for permission when he chuckles?

no big deal

[qwertphobia]

This is no big deal. Snort will continue to be GPL and freely available to the world.

I'm more worried about the recent Nessus changes, have you heard about this?
Nessus License Change Announcement

Nessus 2 will continue to be free
Nessus 3 will be a free of charge, binary only release

Re:no big deal

[Kevin Burtch]

Closed-source penetration testing software?
I sure won't be using that version... and I love nessus!

Re:no big deal

[m50d]

They've been headed that way ever since they did that dodgy plugin licensing thing. Anyone feel like starting a community project to make the free one better?

Re:no big deal

[Anonymous Coward]

OH NOES a company doesn't want to GPL its software and actually MAKE money from it! OH NOES

Once you get out of high school you'll understand how the real world works. Yeah, good luck on your community project that will go nowhere and sit on Sourceforge like phpBB and 99% of other OSS 'projects'

Re:no big deal

[Flower]

Would have been nice if the community had been contributing to Nessus before they closed the source. The only reason Tenable was able to accomplish this is because they wrote all the code. Their code means they can license it anyway they want. If there had been more significant contributions to the codebase outside of Tenable Nessus the latest and greatest version of Nessus would have remained GPL'd. Tenable would have had no choice and I think they would have been happy with that.

And I'm going to be cruelly honest here. I don't think the community is going to make a better free fork. We had our chance and blew it. Like to be proven wrong but I've seen what happened with TripWire and I'm not going to hold out much hope.

Re:no big deal

[Sjobeck]

Both of these are very big deals.

Both of these are very bad.

I am sorrowful today.

Re:no big deal

[puddpunk]

Hahaha. They're not making money, they're giving the binaries away for free!

Oh, and I make plenty of money of phpBB followed by a 10% donation.

Re:no big deal

[Cyno]

I suspect Nessus will be forked soon.

These types of changes don't worry me. Nothing has been lost except future contributions from the original contributor.

I don't care if someone doesn't want to work on Free Software, I only care if they take steps to sabotage it, like Microsoft.

Re:no big deal

[Flower]

You're kidding? Right? So who's going to pick up the tab to create a real lab and do full time testing for plug-ins? Or all the other QA tasks that the community has so far been unable to assist Tenable with. A fork of the codebase does nothing to get that infrastructure back.

To say nothing has been lost is kinda naive.

Re:no big deal

[Cyno]

gnessus.org

So what has been lost? Did Tenable stop testing plugins? Did they dismantle their lab? Is the sky falling?

The relicensed their code. Now we have two options. Eventually, if YOU donate, we might have two labs testing plugins.

But being open source I QA all my own stuff instead of relying on some community project to do it for me. I'm thankful they were nice enough to offer me bandwidth to download the source and license it so I can modify and resell it without the possibility of my changes going into a closed-source-only project. .!..

You also need a benchmark of legit activity.

[khasim]

Everything happening on your network should be authorized by you. If you're worried about security, then you need to get some benchmarks of the legitimate traffic on your network so you can have the system watch for different patterns.

Re:You also need a benchmark of legit activity.

[Tom]

so you can have the system watch for different patterns.

Like someone reading a different e-mail than yesterday? ;-)

Sorry, half-joking there. The problem still is that for any somewhat complicated (i.e. real-life) network, there will be a huge volume of different patterns. You end up doing one of two things:

* Spending huge amounts of time setting up the initial patterns and then updating them every time something small changes

* Going to a level of abstraction where attacks can slip through, so you're no better than with the "look for evil bits" approach, except that you spent more time on it all.

Re:In other news

[Anonymous Coward]

Who are these companies?

Note to non-technical people: either STFU or stay the f*** off of /. Frankly, if you don't know who CheckPoint is, half of the stuff here has to be over your head, anyway.

Can't we have some type of "technical abilities" test, so we can adjust a post's initial score, based on the result? Of course, we'd never see AC posts, but still - it's sad that someone had to use mod points on this.

Re:In other news

[Anonymous Coward]

Can't we have some type of "technical abilities" test, so we can adjust a post's initial score, based on the result?

There is. and you fail it.

Not really.

[khasim]

You'll see port 80 connections to your internal webservers and to external sites ... but you shouldn't see port 80 connections to other workstations. That's a flag.

And so on with every other port. Particularly if you have a well designed network where the workstations have no need to connect to other workstations.

Like someone reading a different e-mail than yesterday? ;-)

Nope. More like a workstation suddenly sending, via port 25 (SMTP), to a box outside your network. That's a huge flag.

It's very easy to do. You should already know what ports/protocols are in use on your network and what should be connecting on them to what. Start there and investigate any usage you didn't expect to see.

Re:Not really.

[Cally]

Nope. More like a workstation suddenly sending, via port 25 (SMTP), to a box outside your network. That's a huge flag.

Yeah, though you'd catch that on the firewall, not with an IDS. For anomaly based detection (which snort can do with 'spade'; I haven't tried it myself) you really want to be able to plug in logs from multiple sources - IDS sensors, internal and external firewall interfaces, etc etc. For most networks, you should be able to iterate over each sensor, f/w interface and other in my dream world, over all the client and server logs which would be forwarded by syslog into one hungous out-of-band management network where you process the lot and alert on anything out of the ordinary. You'll get a lot of 'false alarms' unless you want to know about the curious network newbie who one day wonders what how telnet works, or installs a p2p app or whatever. (Yes, of course your fws and IDS are doing deep packet inspection / protocol analysis and can spot people trying to tunnel p2p over port 80 - the most common case - as well as funkier stuff like ipsec via DNS packet options or somesuch madness. You'd want to automate as much as possible of the setup... hmmm, in principle it'd be possible to stich together a load of Free software, package it or sell it as a service, with a load of auto-discovery scripts or passive analysis system to spot patterns... hmmm....

My dream is to build and run such a system, and work for world peace ;)

Re:Not really.

[jnf]

You'll see port 80 connections to your internal webservers and to external sites ... but you shouldn't see port 80 connections to other workstations. That's a flag.

It's very easy to do. You should already know what ports/protocols are in use on your network and what should be connecting on them to what. Start there and investigate any usage you didn't expect to see.

You must work in a very small organization where this can be said to be true, or have never actually worked in a SOC-- in which case your advice sounds logical. Take your network, add several thousand more boxes all under different clusters of administrators, give clusters of the boxes different purposes, and then re-evaluate your statement to see if it can be held to be true.

My friend was acquired by a Checkpoint

[DrugCheese]

when he tried to cross the border with snort.

in other news...

[portscan]

checkpoint has had yet another security breach. this time, instead of all of their background records being released onto the internet, the source code of their newly acquired security tool, "snort" was released onto the internet. many have already downloaded this and started using free of charge, not to mention modifying it as they see fit and redistributing it also free of charge. this is a truly embarassing second offense for the security company.

You just now heard of Snort???

[ripcrd]

What rock have you been under? If you like to keep up on network admin tools, then you are way behind. I first heard of Snort in 2001 or 2002. Snort runs on my IPCop firewall and scans for baddies trying to get in.

Hell, they are past version 2.4 and you are just NOW hearing about it? Holy crap!

Re:You just now heard of Snort???

[Kiashien]

heh, yea, I know, I know.

Oh well. I know about it now.

Re:You just now heard of Snort???

[Anonymous Coward]

Look at his user ID, he only this morning heard about slashdot!!

Re:You just now heard of Snort???

[Slashcrap]

Snort runs on my IPCop firewall and scans for baddies trying to get in.

It runs on your firewall?

Wouldn't you be better off running it inside your firewall where it is actually useful? Or does looking at huge logs of attacks bouncing off your firewall make you feel special in some way?

You want to know about attacks that get through the firewall not all the script kiddie shit that gets blocked.

And shall we talk about the security problems with your setup? No, let's not bother.

This blows...

[Anonymous Coward]

Sorry for any CPFW1 fans but I think this stinks. CP's software has had a pretty bad history as far as performance(ie. only scales to 50k concurrent connections regardless of size of the firewall). Have you tried calling Isreal to get an activation key? I'd look for CheckPoint to hurt snort like 3com kills any products they offer.

Re:I don't know

[Sjobeck]

honestly, why did you post this?

Is there any value whatsoever for the rest of the planet to read this of yours.

Think thrice, post once, economy of expression; all good things.

Peace.

Cheers.

Re:" Here is a message from Snort creator Marty Ro

[garaged]

i knew snort, and in IRC Marty, when he was unemployed, and planing to make sourcefire, and soon to be a father (dont know if for the first time), and I can tell you I'm pretty happy for his richness, he deserves it.

Re:" Here is a message from Snort creator Marty Ro

[Chris Mattern]

And, of course, the classic.

"Do you like my hat? It's made of money! Would you like to stay for lunch? I think we're having MONEY!"

I acquire a snort...

[SnappingTurtle]

... every time I get one of these damn sinus infections, but I don't put out a damn press release about it.

Re: Fork

[ImaLamer]

"snort" or "snort" as a software product belongs to him, or the company regardless of the licensing scheme attached to the product with the same name.

Who owns copyrights, trademarks, all of that garbage doesn't matter much when you are talking about GPL software. In a sense you are putting everything on the line when you release GPL software but you by no means are giving away the entire farm. The copyright is yours, we've covered this! When people contribute code then their code is © them and not you.

What's important, the initial question, is: What will happen to the code? Can it be put into closed source software?

Some of it could - provided that they (CheckPoint) purchased the rights to that specific code when they bought the farm. Ahem, so to speak. Sourcefire, Martin Roesch, whoever could have sold their code under their copyright's - but they can't remove it from the GPL project and can't prevent others from using it. Really, if someone helped edit a portion of the code during debugging then the developer could only sell a copy of their original submission (because they still retain their copyright; the derivative works aren't theirs because the nature of the license).

If you wrote code for Snort then you don't have anything to worry about (in theory only) unless you signed something. We'll see what happens I guess.

CheckPoint bought ZoneAlarm and screwed it up

[loggia]

I see nothing positive about Snort being acquired by CheckPoint.

CheckPoint bought Zone Labs a couple of years ago and Zone Alarm went from being a rock solid firewall to an absolute mess. There are so many problems with the new version of Zone Alarm that their forums are filled with complaints.

Re:CheckPoint bought ZoneAlarm and screwed it up

[seudafed]

I've worked at Zone Labs for 5 years. I can say that things have gotten better since being acquired by our new corporate overlord. Any problems have nothing to do with the aquisition.

Maybe they did this...

[raddan]

...so that they can find out what's wrong with their shitty VPN software.

What happens with the rule set development?

[waldonova]

I have snort running with BASE, for a nice NID management setup. Without the rules, not much will happen.
There are currently three levels of access to rules, as seen at http://www.snort.org/rules/

1. Anyone can get the rule set that is released with the latest version.
2. People who pay the big bucks ($1,795/year) can get updated rule sets as soon as they are released.
3. A third level sits in the middle; where if you register with sourcefire you can get the updated rules five days after they are released to the premium members.

Martin, I am sure that "Check Point is very excited about continuing Sourcefire's involvement with the open source community!". I hope that doesn't mean that they are excited about getting fees for any and all rules from the open source community.

Re: Fork

[at_slashdot]

"When people contribute code then their code is © them and not you."

That's what I meant, I don't know how much of the code is his and how much is contributed that's why he deosn't own (the whole) snort -- just like Linus doesn't own Linux kernel, AFAIK.

*ARGHH* headline!

[Cally]

'Checkpoint buys Snort' - 10/10 for an arresting headline, minus several billion for good thinking. Checkpoint has bought Sourcefire, not *Snort*. That's like saying OSDN have "bought Linux" because they happen to pay Linus.

Honestly, the "slashdot's going down hill" trolls have been making me roll my eyes pretty much as soon as I became a regular, but things like this really make me wonder :(

Re:In other news

[Anonymous Coward]

Seriously, sometimes it is better to keep ones mouth shut than to say stoopid shit like that. Who are these companies? Who the fuck cares? A lot of folks who use these tools care. Just because you are ignorant of something, that doesn't mean it doesn't matter.

Re:In other news

[Frank T. Lofaro Jr.]

You got a big Mac at Fry's?

How's OSX? ;)

Kate Moss

[Anonymous Coward]

Kate Moss unavailable for comment.

Here's my question

[Flower]

How much *significant* code has been contributed to Snort by people outside of SourceFire? I'm talking about things like Frag3, etc. - the underpinnings of Snort.

Snort was a good model for IDS

[recharged95]

Problem is all the competitors have better tools out there [or in the works...] now for IDS. Believe me, it's just no one's buying.

The neat thing about snort is it's history and that I hope companies look at it as a model of S/W developement (i.e. FOSS). I wish they turn their rules language via an XML Schema.

Interesting triva to ask is where did snort originate? The feds come to mind ;).

[Funny] It's understandable why Marty had to sell! A big house and a brand new [huge] office building for the peeps (better than the last location) will suck the $$$ dry quickly.

Re:Snort was a good model for IDS

[Anonymous Coward]

From the Air Force.

Marty's game face

[Anonymous Coward]

[Checkpoint] "largest and most respected security companies in the world"

Huh?

How is the parent a Troll?

[Philip K Dickhead]

References:
http://archives.neohapsis.com/archives/firewalls/2 000-q3/2361.html
http://www.issociate.de/board/post/218692/The_prob lem_with_Zone_Alarm.html
http://www.forbes.com/forbes/2002/0318/102_2.html
http://www.whatreallyhappened.com/spyring.html

Re:How is the parent a Troll?

[Anonymous Coward]

Because, Mr Dickhead, it _was_ a troll.

And as to those "references" One debunks any backdoor theory, another is idle speculation that is drowned in ridicule, the third is just a profile of the head of CheckPoint and the third doesn't even mention Checkpoint or Firewalls until the last paragraph where it says "OMG USA businesses use Firewall-1 and Checkpoint is from ISRAEL!!!ONE!!!" (Not to mention that the site itself looks like a crackpot conspiracy theory site).

Re:In other news

[Anonymous Coward]

Why the hell do people blog with grey-on-white and tiny letters?

This is Great day for Snort Users

[easternerd]

I am very sure that Checkpoint would not remove Snort from GPL, and its a good news for all the snort fans out there.. with Checkpoints popularity and financial power they might be able to improvise the snort to be able to offer better Inline IPS features..
The main reason i am very enthusiastic is that there is not much competition in the IDS sphere, and checkpoint systems for one doesnt have a base in IDS hence with this acquisition i guess there will be good competition for Cisco , MCafee and TippingPoint.

just hope to get the best anyway...

Checkpoint starting a "war"?

[Anonymous Coward]

I hate to state the obvious here - Checkpoint just launched a direct attack on Symantec, Cisco and McAfee as the real all around security players. This was totally unexpected from the outside but I guess at some point the consolidation of the security product market had to begin. So which one do you think will be the first to buy a real SIM solution? In my mind Cyberwolf and Protego didn't really count as full SIM products as they only represented about 1/5 of the power of some of the more advanced SIMS out there today.