Forest Global Training Partners

Cyber Risks · Cisco Talos

Checking Multiple Bits in a Flag Field

Summary: Cisco Talos describes how the Sourcefire VRT built a Snort rule to detect Kaminsky DNS attack back scatter by spotting excessive NXDOMAIN packets, which required testing the four-bit return code field inside the fourth byte of the DNS response. Because a single byte_test on the value 6 fails when other flags in that byte are set, and a bitwise AND for 6 returns true if either bit is set, the rule checks each individual bit with its own byte_test, skipping the most and least significant bits for performance reasons.

What's compelling: The rule accepts a deliberate false-positive tradeoff, relying on a threshold and on other rcode values not heavily overlapping those two bits, so detection fidelity here rests on tuning rather than on an exact single-field match.

Read the original at Cisco Talos ↗

Topics
Malware
Related