On 29 Dec 2004, Andy Fewtrell wrote:

> I have not tested these methods but after discussing them with eth00, we
> both think it was better to post this to bugtraq in the hopes it may
> help other people prevent future attacks from new variations of this
> worm and help development of fixes to prevent future problems. While
> this worm currently uses perl it can be obviously re-written to avoid
> obvious mod_security (and other) rules. I could write proof of concept
> versions of the sanity worm but I feel it would be better to leave this
> out of the post.
>
> For those more interested in the mod_security rules:
>
> SecFilterSelective THE_REQUEST "wget "
> SecFilterSelective THE_REQUEST "perl "
> SecFilterSelective THE_REQUEST "lynx "
> SecFilterSelective THE_REQUEST "ftp "
> SecFilterSelective THE_REQUEST "scp "
> SecFilterSelective THE_REQUEST "rcp "
> SecFilterSelective THE_REQUEST "cvs "
> SecFilterSelective THE_REQUEST "telnet "
> SecFilterSelective THE_REQUEST "ssh "
> SecFilterSelective THE_REQUEST "echo "
> SecFilterSelective THE_REQUEST "nc "
> SecFilterSelective THE_REQUEST "mkdir "
> SecFilterSelective THE_REQUEST "cd /tmp"
> SecFilterSelective THE_REQUEST "cd /var/tmp"

Hi Andy, I have a concern with these filters in that they will may
potentially catch quite a few false positives.

In addition to the first one coming from modsecurity.org, I've added a
couple more:

SecFilterSelective ARG_highlight %27
SecFilterSelective ARG_highlight %2527
SecFilter "visualcoders\.net/spy\.gif\?\&cmd"
SecFilter ":/"
SecFilter "'"

Source: http://castlecops.com/article-5642-nested-0-0.html

Your filters I see as good for those who are ultra paranoid. Because they
are looking at THE_REQUEST, and if say "wget " is found in it, it'll be
406'd.

THE_REQUEST: http://modules.apache.org/doc/Intro_API_Prog.html

"the_request - string which just contains the first line of the request.
(e.g. "GET /index.html HTTP/1.0")"

If that is correct, then filtering on those custom keywords can indeed
spawn some false positives. The biggest issues as I see it are the use of
' and/or :/ in the_request. Unless a website is doing redirects, aka:

http://example.com/redirect.jsp?http://example.net/index.html

Then I don't see a real need to include the ":/" (or "://"). The other
aspect to it is the tick mark "'", such an integral component to SQL
injections, or even escaping shell commands.

Using the mod_security filter I provided above, it has stopped over
300,000 attacks in a 55 hour period. I've provided some examples, with
some analysis of what other alternatives can be used. But the big one I
think is the mod_security filters.

--
Regards,

Paul Laudanski - Computer Cops, LLC. CEO & Founder
CastleCops(SM) - http://castlecops.com
Promoting education and health in online security and privacy.

[ reply ]