topic Re: Gumblar Bot Net - IPS Signatures in Network Security

Gumblar Bot Net - IPS Signatures

solinal01 — Sun, 10 Mar 2019 11:38:47 GMT

According to Cisco's bulletin, they do not have any signatures recommended to stop the Gumblar Bot Net. However, a client of ours, uses IBM's Proventia and they currently have a list of signatures they recommend to block.

IBM: http://www.iss.net/threats/gumblar.html

Cisco: http://tools.cisco.com/security/center/viewAlert.x?alertId=18286

Since I'm new to the IPS realm, I'm curious if I can basically set to block all of the PDF related remote execution/vulnerabilities and curious if this will help us in mitigating this attack.

Thanks for any guidance you may give.

Re: Gumblar Bot Net - IPS Signatures

yuliang13 — Mon, 01 Jun 2009 01:02:44 GMT

perhaps you need to write a custom signature

Re: Gumblar Bot Net - IPS Signatures

solinal01 — Mon, 01 Jun 2009 11:16:48 GMT

Well considering I'm new to all of this, I guess that is not going to happen.

Thanks.

Re: Gumblar Bot Net - IPS Signatures

clausonna — Wed, 10 Jun 2009 18:42:43 GMT

Ask, and ye shall receive:

Create a custom sig using the service-http engine. Set it for TCP and use the built-in WEBPORTS variable for common ports (although in the case you can probably do tcp/80.)

Specify the Argument Name Regex as:

((action=).*(&entity_list=).*(&uid=).*(&first=).*(&guid=).*(&rnd=).*)

Full disclosure: this is my first real attempt at using Regex in an IPS sig. I would assume there are better ways to write this regex; this is just what I came up with.

What the regex is saying is "match exactly on the string "action=" followed by any character (the '.') any number of times (the '*'), followed by the the string (&entity_list=) etc. They have to be in that exact order. In this version it has to be a case-sensitive match. It should really be broken down like: ([Aa][Cc][Tt][Ii][Oo][Nn][=]) but the malware isn't exhibiting that behavior yet, so...

You want to swap the attacker/victim setting to (i.e. even though its an internal host that's initiating the traffic, its really the destination that's the bad guy.)

For what its worth, I would think that the Cisco guys should be able to create this as a real sig for inclusion in their updates. If you guys are interested I can try converting more of the Emerging Threat (emergingthreats.net) sigs to be Cisco IPS sigs.

Re: Gumblar Bot Net - IPS Signatures

solinal01 — Wed, 10 Jun 2009 18:47:36 GMT

Sweet - thank you thank you thank you!!

Unfortunately, I cannot 'test' this, and since this would be my 'first' one, I would like to test before I place into production....our licenses are 'mixed up' for my lab ASA/IPS....as soon as that is ironed out - I will definitely attempt this!

Thank you again!

Lillian

Re: Gumblar Bot Net - IPS Signatures

clausonna — Wed, 10 Jun 2009 19:24:49 GMT

Happy to help. I strongly recommend testing this sig first, since Regex is CPU intensive (and since, as I mentioned, I'm new to writing Regex sigs). You could remove some of the 'inside' Arg Names to simplify the regex (ie. get rid of the &first= or &guid= names)

I've already had a true positive hit on this sig, from a guest machine on my network. Here's the HTTP GET that the infected client issued:

GET /garret/controller.php?action=bot&entity_list=2351576910,1212183482,1232434&uid=1&first=0&guid=22439923423&rnd=9242 HTTP/1.1

Host: hott-rodd.cn

Going against destination IP 204.69.199.39.

Good luck.