Hi Abhishek Bhuyan,
I think you are mixing every thing evasion false positive, exploit specific , bit exploit specific and vulnerability specific and you propose to be creative in writing exploit specific. Then you are claiming client side rules/signatures/filters give more false positive then web server side. Have you performed any study for your claims?? Can you please share the results with us ? What was you benchmark and the test setup for your study and claims ? What do you mean by creative in writing exploit specific filter? In response to your query about not being able to understand "to have a signature or rule which will create a region where other vulnerability specific rules can operate " You have mentioned some thing about file format decoder. What is the purpose of file format decoder?? Abhishek Bhuyan (abhuyan gmail com) says ---- abhicc - I didn't understand what you mean by "to have a signature or rule which will create a region where other vulnerability specific rules can operate." What I meant to tell is, there are more chances for false positive in client-side HTTP. Understanding of protocol is necessary, but I don't understand how it's related to false positive. There might be a vulnerability in a webserver where if GET request is more than 256 characters might crash, doesn't mean there cannot be GET request with more than 256 characters. (if you consider writing generic filters) hirosh - We are not coming to the argument of exploit Vs vulnerability nor about how fast we can write rules. Say tackling file format vulnerabilities, you can do some sort of file format decoder, but that too will be complex. Specially client-side, there are way too many evasion tactics. You can also be creative in writing exploit specific filters :) If we just look for AAAA, it will be hard to survive in the industry :) -Abhishek ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
