Re: Sanity Worm Concepts

[Paul Laudanski <zx@xxxxxxxxxxxxxx>]

On 29 Dec 2004, Andy Fewtrell wrote:

> I have not tested these methods but after discussing them with eth00, we
> both think it was better to post this to bugtraq in the hopes it may
> help other people prevent future attacks from new variations of this
> worm and help development of fixes to prevent future problems. While
> this worm currently uses perl it can be obviously re-written to avoid
> obvious mod_security (and other) rules. I could write proof of concept
> versions of the sanity worm but I feel it would be better to leave this
> out of the post.
> 
> For those more interested in the mod_security rules:
> 
> SecFilterSelective THE_REQUEST "wget "
> SecFilterSelective THE_REQUEST "perl "
> SecFilterSelective THE_REQUEST "lynx "
> SecFilterSelective THE_REQUEST "ftp "
> SecFilterSelective THE_REQUEST "scp "
> SecFilterSelective THE_REQUEST "rcp "
> SecFilterSelective THE_REQUEST "cvs "
> SecFilterSelective THE_REQUEST "telnet "
> SecFilterSelective THE_REQUEST "ssh "
> SecFilterSelective THE_REQUEST "echo "
> SecFilterSelective THE_REQUEST "nc "
> SecFilterSelective THE_REQUEST "mkdir "
> SecFilterSelective THE_REQUEST "cd /tmp"
> SecFilterSelective THE_REQUEST "cd /var/tmp"

Hi Andy, I have a concern with these filters in that they will may 
potentially catch quite a few false positives.

In addition to the first one coming from modsecurity.org, I've added a 
couple more:

    SecFilterSelective ARG_highlight %27
    SecFilterSelective ARG_highlight %2527
    SecFilter "visualcoders\.net/spy\.gif\?\&cmd"
    SecFilter ":/"
    SecFilter "'"

Source: http://castlecops.com/article-5642-nested-0-0.html

Your filters I see as good for those who are ultra paranoid.  Because they 
are looking at THE_REQUEST, and if say "wget " is found in it, it'll be 
406'd.

THE_REQUEST: http://modules.apache.org/doc/Intro_API_Prog.html

"the_request - string which just contains the first line of the request. 
(e.g. "GET /index.html HTTP/1.0")"

If that is correct, then filtering on those custom keywords can indeed 
spawn some false positives.  The biggest issues as I see it are the use of 
' and/or :/ in the_request.  Unless a website is doing redirects, aka:

http://example.com/redirect.jsp?http://example.net/index.html

Then I don't see a real need to include the ":/" (or "://").  The other 
aspect to it is the tick mark "'", such an integral component to SQL 
injections, or even escaping shell commands.

Using the mod_security filter I provided above, it has stopped over 
300,000 attacks in a 55 hour period.  I've provided some examples, with 
some analysis of what other alternatives can be used.  But the big one I 
think is the mod_security filters.

-- 
Regards,

Paul Laudanski - Computer Cops, LLC. CEO & Founder
CastleCops(SM) - http://castlecops.com
Promoting education and health in online security and privacy.