New Location For (Bleeding-Edge) Snort Sigs

Vantage writes "A few of us have gotten together and built a snort 'signature repository.' ... This is a place for everyone to post their personal and company-made signatures and to take a look at and use those submitted by others. It is by no means a replacement for the snort.org signature base, but it will help to get signatures out there for brand new vulnerabilities. We are hoping that those snort users in the /. community will add there sigs to this database. We are looking to add any and all signatures herem so please feel free to post all of your sigs."

Um.. built?

[Nutcase]

Maybe it's just me, but isn't the link pointing at a raw phpbb2 install with very very little customizaiton?

Is this just a forum for posting stuff, with the concept being "post snort sigs here asap"?

Why would anyone anywhere use this? you lose all the potential that the concept has by slamming it into a generic system. Why not create a db system that has various intrusion characteristics as bools, and you can attach a sig to a textual report with flagged characteristics, and then let admins and such search the db by characteristic or description text, or affected apps/protocols, etc. Other admins could hit a "have seen in wild" button to let the site rank various intrusion techniques by how common they are.. There is a lot of potential, and it is all squandered. Back to the drawing board.

Re:Um.. built?

[sinergy]

Great ideas. Too bad I think the only response you'll likely get on here by suggesting all of this is "why don't you do it yourself."

Re:Um.. built?

[Nutcase]

Hehe. I probably could build the app, but I don't know anything about intrusion detection at all, and don't have the time to learn. (And thus I have no desire to spend the time building the app)

Those ideas were just from looking at what snort is on their page, and taking a guess at what a snort sig does based on the post and the app page.

My first thought was that this entire story was just a clever troll of some type. I mean, my ideas took about 2 minutes from a complete dead start with no real interest i

phpBB2?

[Ianoo]

That's like, what, a five click install process? No offense, but it doesn't strike me as the ideal software for doing this, let alone hard to set up. You haven't even customised it. You haven't even bought a domain name for this site. It's an interesting idea, but you really need to work on your web marketing skills. But it won't matter, since on a shared server with a MySQL backend I expect the site will be /.ed in about T-minus five minutes.

MySQL database login details

[Anonymous Coward]

See who will be the first to hack the site:

config.php [gitflorida.com]

Re:MySQL database login details

[Ianoo]

... and these guys claim to be a security company [gitflorida.com]?

Re:MySQL database login details

[Nutcase]

No wonder their name starts with 'git'

(too british, i wonder?)

Re:MySQL database login details

[JWSmythe]

I've heard it in American law enforcement. I believe it has the same meaning. :) Usually meaning a juvenile, and acting exactly as one.

Re:MySQL database login details

[$rtbl_this]

IIRC, the literal meaning is "a pregant camel". That one doesn't come up too often, though.

Re:MySQL database login details

[Vantage]

Uhhh well looking at a default phpBB directory that is not active and not connected to a DB I feel pretty safe that the info there is useless to you....

quickly set up crappy site

[pizza_milkshake]

it's so bleeding edge, there's no time to set things up! hurry!

Systems

[Vantage]

Well we are working on other options this seamed like the easiest and fastest way to get the idea off the ground... Does anyone have any software suggestions... Other than slashcode?? We are looking at CVS....

Re:Systems

[JWSmythe]

Write one? How hard is it to put together a few pages to insert and read a table? Then it'll do exactly what you want it to do, without a bunch of fluff.

I don't recommend Slashcode. It's really big, and does lots and lots of great stuff, but literally you'll spend the first month trying to figure the whole thing out. If you want a site like Slashdot, then go for it, but it didn't appear that's what you were trying to do.

Re:Systems

[jrexilius]

One of the earlier posts had a few suggestions that may have been worthwhile that would require a bit of customization.

What, in addition to public access to shared sigs, are you really trying to get at? Would a moderation/voting/popularity function be desired, a wiki-style public read/write forum where they could evolve, better search and classification capabilities, etc.?

By the way, its not a bad idea, but it would have helped to be more descriptive in your vision for it and maybe better tool selection.

Snorting cigs?

[Carnildo]

I thought cigs were something you smoked, not something you snorted!

Re:Snorting cigs?

[theefer]

Looking at the website, I would say they were not aware of that.

Re:What the fuck is a 'snort'?

[illuvata]

The Open Source Network Intrusion Detection System [snort.org]

Re:What the fuck is a 'snort'?

[isorox]

You're thinking of Snarf

That would require editors.

[EnglishTim]

And Slashdot doesn't have editors.

RE: Snort rules

[atomic-penguin]

Doesn't snort.org keep a public repository of Snort signatures? I am pretty sure anyone can make a submission to their set of rules. It's open-source software, rather than forking rules elsewhere they should be submitted to the sourceforge group (so they can be corrected, improved, built into the software as preprocessors and so on). Maybe I am misunderstanding something. I don't really understand the point of doing this.
I maintain 3 snort servers. Most of my snort rules are very uninteresting, and are used in limiting alerts, and getting rid of false positives due to limited computer resources. We cannot afford to have 10,000 or more alerts per day. The most interesting thing I have written for snort is a simple update utility that gets new rules every 24 hours.

Just my 2 cents.

Re: Snort rules

[Vantage]

If you like submit the update utility... I use oinkmaster and have had good luck but if someone has another option... it would be interesting to look at.

As for the reasoning behind this. I have debated this with dozens of people in the last week. Snort.org and the sourceforge snort list are great resources.. but few people submit things that they think are only good for there INTERNAL use and nothing makes it into the signature-base until it gets approved... in my instalation and in others there is