Newsgroup: it.comp.sicurezza.varie
Titolo: Snort and Sneeze

Interessante articolo su phrack:
http://www.phrack.nl/phrack62/p62-0x0d.txt
"Snort is a piece of shit, and a pretty basic piece of shit at that. I'm
not sure exactly who Marty Roesche is, but judging by the sheer volume of
off-by-one's, integer overflows, and logic bugs I found in his code, he
was probably subject at one point to an intense training session by the
Shmoo Group."...
K
-- 
-- 
<<And if all others accepted the lie which the Party imposed -if all records
told the same tale -- then the lie passed into history and became truth.>>,
George Orwell, 1984.

 wrote in message
news:bkjp9a$2jpou$1...@ID-186319.news.uni-berlin.de...


 > Shmoo Group."...
Ops! sorry...
Quindi stando alle info che sono riuscito a raccogliere, ci fu un secuirty
incident qualche tempo fa dove il gruppo PHC riusci' ad accedere e a
compromettere Snort CVS tree.
Sourcefire fece un enorme lavoro di auditing sull'intero source code. Ma la
notizia dell'attacco non avvenne via Sourcefire ma tramite blackhats che
rilasciarono un falso phrack...
K

 wrote in message news:bkl2s2$2unos$1@ID-
Questa e' la risposta di Martin Roesch:
:
It's come to my attention that some group is claiming to have broken
into a Sourcefire server and backdoored the Snort source code. First
things first, there is no backdoor in Snort nor has there ever been,
everyone can relax.
A shell server got compromised well over a year ago, but what these
guys aren't telling you is that the network that it was on was not only
logically separate from the rest of the 
sourcefire.com
 domain, it was
also physically removed from it too (by about 23 miles, approximately
the distance from the Sourcefire office to my basement). Yes, that's
right, they busted into a shell server that was maintained on a
physically separate network in my basement. That particular machine
was maintained as a shell server for various people to log into so that
we can have a sacrificial box to use to chat on IRC without having to
worry about our real network getting compromised, and it has served its
purpose well.
While we do try to keep that system from suffering break-ins, we also
realize that many IRC clients aren't exactly the most secure pieces of
code in the world and sometimes there are problems in server code as
well (like apache and sshd), so we put together servers like that one
so that we can interact with people while minimizing the risks to the
company's networks and servers. I thought this was fairly standard
practice for many security companies, maybe I'm wrong.
If you're wondering "how do you know the code isn't backdoored?", since
we know that that server is an "at risk" server we're not in the habit
of checking code into CVS from there. If that's not good enough for
you, Snort has been through three code audits since March (one
Sourcefire internal, two third-party external) and there are most
definitively no backdoors in the code, nor were there any.
Hope that clears things up.
BTW, the sample code that they put into their little screed was nothing
more than an update of the 'stick' program from 2001, not really
anything to get worked up about.
-Marty
-
Martin Roesch - Founder/CTO Sourcefire Inc. - 
(410) 290-1616
Sourcefire: Enterprise-class Intrusion detection built on Snort
roe...@sourcefire.com
 - 
http://www.sourcefire.com
Snort: Open Source Network IDS - 
http://www.snort.org

 Questa e' la risposta alla risposta di Martin Roesch:
I just finished reading Phrack 62's article on Sneeze, and some of the
threads here concerning the matter, and I must admit that I am bothered by
some of the responses. There is nothing I hate quite as much as vendors who
lie to their customers, except perhaps vendors that are too stupid to
realize what really happened. I guess Marty assumes that anyone dumb enough
to buy the hype of signature-based IDS and to think products like
Snort/OpenSnort have any value as a security mechanism, is going to be too
stupid to think independantly to arrive to a conclusion to what most likely
did happen with the Snort.org compromise.
First, if you look at the output from 'w' (I read a great article by BMcW
talking about the unix command 'w' being run on the ever-secure
cvs.openbsd.org
 by a malicious intruder, thanks Brian!), you'll notice that
users from the hacked box were logging in to 
www.sourcefire.com
, and some
nameservers. The compromise must definately have been limited to that single
machine! No intruder would be smart enough to log authentication credentials
on one hacked machine to get to anther!
Second, Marty speaks about the machine being "removed" from the rest of
their network so if it gets compromised, it doesn't actually affect the
Snort/Sourcefire network's security. Yet being proactively secure, and
assuming that a machine si going to get compromised, then logging into your
corporate network from that machine doesn't seem like a very intelligent
practice now, does it? Security is policy based, and these dopes can't
understand that.
Some good questions are:
1) If the intrusion were limited to a single "shellbox" then why did they
need to audit the code in CVS to see if it was backdoored?
2) If the Snort developers cannot configure Snort to detect attacks on their
own networks, why are you hiring Sourcefire to install said mechanisms on
your network to protect you?
3) Why the fuck do people still thing signature-based IDS is worthwhile?
Get a clue, everyone.
Marty - I look forward to your reply here; we'll follow up with a critique
of your incoherent coding practices.l
K