Forest Global Training Partners

Cyber Risks · Cisco Talos

Using byte_jump as a Detection Mechanism

Summary: Cisco Talos described writing a Snort shared object rule for a common vulnerability where the DATA section's size field is smaller than the actual remaining payload, causing an overflow when the server copies all remaining bytes. Talos found that a simple text rule using byte_jump, which normally moves the detection cursor to another payload location, can serve as the detection mechanism itself by alerting when extra data follows the specified size.

What you should know: The detection hinges on a four-byte big-endian size field in the payload, so a rule that only reads the declared size and not the bytes actually left will miss the overflow condition entirely.

Read the original at Cisco Talos ↗

Topics
Malware
Related